Didier Stevens

Tuesday 29 June 2010

Quickpost: No Escape From PDF

Filed under: PDF,Quickpost,Vulnerabilities — Didier Stevens @ 18:41

Adobe has released a new Adobe Reader version with a fix for my /Launch action PoC PDF.

Before version 9.3.3:

Since version 9.3.3:

Not only is the dialog box fixed, but the /Launch action is also disabled by default.

Quickpost info

Friday 25 June 2010

Solving the Win7 Puzzle

Filed under: PDF,Puzzle — Didier Stevens @ 9:39

The Win7 puzzle is actually a “PDF bomb”, something I’ve hinted at long ago but I hadn’t published a sample.

The PDF contains a doubly compressed object stream, which is around 100 MB large when uncompressed. Some of you might have experienced problems opening this PDF file in your favorite PDF reader, this is because it couldn’t handle an uncompressed stream of 100 MB. Which isn’t actually that large, a PDF bomb of 1 GB or 10 GB isn’t that much larger in compressed form…

If you used my pdf-parser, you’ve also encountered a problem. The objects lack the endobj keyword. A simple solution: add the missing keyword and extract the stream with my parser. The stream is 100 MB of spaces, with a small text in the middle: “De Ultieme Hallucinatie”. One way to extract this text is to trim the spaces of the 100 MB string.

If you’re interested in different solutions, be sure to read the comments of the Win7 Puzzle.

De Ultieme Hallucinatie (The Ultimate Hallucination) was a nice Art Nouveau cafe/restaurant in Brussels. But the Windows 7 Ultimate license won by Vincent is no ultimate hallucination 😉

Thursday 3 June 2010

A Win7 Puzzle…

Filed under: Puzzle — Didier Stevens @ 20:15

I’m presenting you a little puzzle…

The prize is a Windows 7 Ultimate license. Unless you don’t care for Windows, then you get a sticker 😉

The puzzle contains a text. Find it and post it in a comment to this post. You don’t have to be the first with the correct text to win. This challenge will run for a week, and I’m randomly selecting a winner from all the correct entries.

Comments are moderated and will not appear as long as the challenge is on.

Download the puzzle and find the text.

Blog at WordPress.com.